<div dir="ltr">Lucimara muchas gracias por compartir.<div>Saludos a todos.</div><div><br></div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div style="font-size:small" dir="ltr"><strong>Carina Birarda</strong><br><br></div><div dir="ltr"><div dir="ltr" style="font-size:small">Security & Business Continuity Consultant</div><div dir="ltr" style="font-size:small">C|CISO®, ISO27001LA® v.2013, ISO22301LA®, CCSK® Cloud Security</div><div dir="ltr" style="font-size:small"><br></div><div style="font-size:small"><a href="https://about.me/carinabirarda" target="_blank">https://about.me/carinabirarda</a></div><div style="font-size:small">Mobile: (+54 911) 3339.6762<br>IM: carinabirarda (Skype)</div><div style="font-size:small"><br></div><div style="font-size:small"><b><font color="#38761d" size="1" style="background-color:rgb(238,238,238)">No lo imprimas, si no es necesario, cuidemos el planeta entre todos.</font></b></div><div style="font-size:small"><br><font size="1">WARNING OF CONFIDENTIALITY: The information contained and transmitted here is CONFIDENTIAL and can contain information protected by the professional secret. It is for exclusive use of the addressee above indicated, and for his specific use. If you are not the addressee, we apologize for any inconvenience caused so far. It is hereby notified that it is prohibited to revise or broadcast or any other type of use of the Information contained by <br>people who are not the original addressee. If you have received this information by mistake, please contact the sender and eliminate the information contained here of all computers. </font></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">2017-10-23 10:25 GMT-03:00 Lucimara Desiderá <span dir="ltr"><<a href="mailto:lucimara@cert.br" target="_blank">lucimara@cert.br</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><a href="http://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/" rel="noreferrer" target="_blank">http://blog.netlab.360.com/<wbr>iot_reaper-a-rappid-spreading-<wbr>new-iot-botnet-en/</a><br>
<br>
<br>
IoT_reaper: A Rappid Spreading New IoT Botnet<br>
20 October 2017 on IoT Botnet, Botnet, Mirai<br>
<br>
On 2017-09-13 at 01:02:13, we caught a new malicious sample targeting<br>
IoT devices. Starting from that time, this new IoT botnet family<br>
continued to update and began to harvest vulnerable iot devices in a<br>
rapid pace.<br>
<br>
The bot borrowed some code from the famous mirai botnet, but it does not<br>
do any password crack all. Instead, it purely focuses on exploiting IoT<br>
device vulnerabilities. So, we name it IoT_reaper.<br>
<br>
IoT_reaper is fairly large now and is actively expanding. For example,<br>
there are multiple C2s we are tracking, the most recently data (October<br>
19) from just one C2 shows the number of unique active bot IP address is<br>
more than 10k per day. While at the same time, there are millions of<br>
potential vulnerable device IPs being queued into the c2 system waiting<br>
to be processed by an automatic loader that injects malicious code to<br>
the devices to expand the size of the botnet.<br>
<br>
Currently, this botnet is still in its early stages of expansion. But<br>
the author is actively modifying the code, which deserves our vigilance.<br>
<br>
Here we are sharing some quick summary so the security community may<br>
stop its before it causes bigger damage.<br>
>From Mirai, Beyond Mirai<br>
<br>
The botnet partially borrows some mirai source code, but is<br>
significantly different from mirai in several key behaviors, including:<br>
<br>
No longer crack any weak password, only exploit IoT devices<br>
vulnerabilities;<br>
A LUA execution environment integrated, so more complex attacks can<br>
be supported and carried out;<br>
Scan behavior is not very aggressive, so it can stay under the radar.<br>
<br>
Sample Delivery, C2 Distribution and Traffic Pattern<br>
<br>
Take hxxp://<a href="http://162.211.183.192/sa" rel="noreferrer" target="_blank">162.211.183.192/sa</a> as an example, IoT_reaper's sample<br>
delivery and C2 distribution are as follows. There is a downloader,<br>
quite different from Mirai:<br>
<br>
downloader: 162.211.183.192, samples can be downloaded from this<br>
server and it usually uses "d" as subdomain, like <a href="http://d.hl852.com" rel="noreferrer" target="_blank">d.hl852.com</a><br>
controller: 27.102.101.121, which can control bots, send commands<br>
and usually uses "e" as subdomain, like <a href="http://e.hl852.com" rel="noreferrer" target="_blank">e.hl852.com</a><br>
reporter: 222.112.82.231, which is used to receive potentially<br>
vulnerable device info collected by bots, it usually uses "f" as<br>
subdomain, like <a href="http://f.hl852.com" rel="noreferrer" target="_blank">f.hl852.com</a>.<br>
loader: 119.82.26.157, implants bot program through vulnerabilities<br>
into devices collected by reporter<br>
<br>
The following figures shows traffic pattern of the above 4 IPs：<br>
9 IoT Vulnerability Exploits Integrated in the Malware<br>
<br>
Unlike Mirai that uses weak password cracking, IoT_reaper infects IoT<br>
devices by exploiting multiple IoT device vulnerabilities.<br>
<br>
We noticed 9 IoT vulnerability exploits have been integrated into<br>
current samples as follows:<br>
<br>
Dlink <a href="https://blogs.securiteam.com/index.php/archives/3364" rel="noreferrer" target="_blank">https://blogs.securiteam.com/<wbr>index.php/archives/3364</a><br>
Goahead<br>
<a href="https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html" rel="noreferrer" target="_blank">https://pierrekim.github.io/<wbr>blog/2017-03-08-camera-<wbr>goahead-0day.html</a><br>
JAWS <a href="https://www.pentestpartners.com/blog/pwning-cctv-cameras/" rel="noreferrer" target="_blank">https://www.pentestpartners.<wbr>com/blog/pwning-cctv-cameras/</a><br>
Netgear <a href="https://blogs.securiteam.com/index.php/archives/3409" rel="noreferrer" target="_blank">https://blogs.securiteam.com/<wbr>index.php/archives/3409</a><br>
Vacron NVR <a href="https://blogs.securiteam.com/index.php/archives/3445" rel="noreferrer" target="_blank">https://blogs.securiteam.com/<wbr>index.php/archives/3445</a><br>
Netgear <a href="http://seclists.org/bugtraq/2013/Jun/8" rel="noreferrer" target="_blank">http://seclists.org/bugtraq/<wbr>2013/Jun/8</a><br>
Linksys <a href="http://www.s3cur1ty.de/m1adv2013-004" rel="noreferrer" target="_blank">http://www.s3cur1ty.de/<wbr>m1adv2013-004</a><br>
dlink <a href="http://www.s3cur1ty.de/m1adv2013-003" rel="noreferrer" target="_blank">http://www.s3cur1ty.de/<wbr>m1adv2013-003</a><br>
AVTECH <a href="https://github.com/Trietptm-on-Security/AVTECH" rel="noreferrer" target="_blank">https://github.com/Trietptm-<wbr>on-Security/AVTECH</a><br>
<br>
Note just in the last 10 days, the attacker has continuously added more<br>
new exploits into samples, one of which is adopted only 2 days after the<br>
disclosure of the vulnerability was made.<br>
<br>
Vacron NVR remote exploit was exposed on 2017-10-08 and was added<br>
into bot sample before 2017-10-10;<br>
3 and 1 exploits are added separately in two updates on 2017-10-12<br>
and 2017-10-16;<br>
<br>
The LUA Execution Environment Integrated in the Malware<br>
<br>
Md5: CA92A3B74A65CE06035FCC280740DA<wbr>F6<br>
Based on the integrated LUA execution environment, author will be able<br>
to write very complex and efficient attack scripts now<br>
Approximately 100 DNS Open Resolvers Were Integrated in This Malware<br>
<br>
The botnet has embedded more than 100 DNS open resolvers in its lua<br>
sample, so dns amplification attack can be easily carried out. And a<br>
cross-checking with our DRDoS data feed indicates that about one-third<br>
of these open DNS servers have been used as reflector in real dns<br>
amplification attacks. We have yet to see this type of config in any<br>
other mirai variants.<br>
No DDoS Attack Command observed Till Now<br>
<br>
In terms of attacking command, although we saw support of DDoS attack in<br>
the source file of Lua execution environment, we have not seen actual<br>
DDoS attack so far. The only instructions we saw are to download<br>
samples. This means the attacker is still focusing on spreading the botnets.<br>
Infection Measurement<br>
<br>
By using some tricks, we are able to draw some fairly accurate<br>
measurement on the scale of the infection, here are a sample of the numbers.<br>
<br>
Number of vulnerable devices in one c2 queue waiting to be infected<br>
: over 2m;<br>
Infected bots controlled by one c2 in last 7 days: over 20k ;<br>
Number of daily active bots controlled by one c2 : around 10k for<br>
yesterday(October 19) ;<br>
Number of simultaneous on-line bots controlled by one c2 : around 4k<br>
<br>
IoC URLs<br>
<br>
hxxp://<a href="http://cbk99.com:8080/run.lua" rel="noreferrer" target="_blank">cbk99.com:8080/run.lua</a><br>
hxxp://<a href="http://bbk80.com/api/api.php" rel="noreferrer" target="_blank">bbk80.com/api/api.php</a><br>
hxxp://<a href="http://103.1.221.40/63ae01/39xjsda.php" rel="noreferrer" target="_blank">103.1.221.40/63ae01/<wbr>39xjsda.php</a><br>
hxxp://<a href="http://162.211.183.192/down/server.armel" rel="noreferrer" target="_blank">162.211.183.192/down/<wbr>server.armel</a><br>
hxxp://<a href="http://162.211.183.192/sa" rel="noreferrer" target="_blank">162.211.183.192/sa</a><br>
hxxp://<a href="http://162.211.183.192/sa5" rel="noreferrer" target="_blank">162.211.183.192/sa5</a><br>
hxxp://<a href="http://162.211.183.192/server.armel" rel="noreferrer" target="_blank">162.211.183.192/server.<wbr>armel</a><br>
hxxp://<a href="http://162.211.183.192/sm" rel="noreferrer" target="_blank">162.211.183.192/sm</a><br>
hxxp://<a href="http://162.211.183.192/xget" rel="noreferrer" target="_blank">162.211.183.192/xget</a><br>
hxxp://<a href="http://198.44.241.220:8080/run.lua" rel="noreferrer" target="_blank">198.44.241.220:8080/<wbr>run.lua</a><br>
hxxp://<a href="http://23.234.51.91/control-ARM-LSB" rel="noreferrer" target="_blank">23.234.51.91/control-<wbr>ARM-LSB</a><br>
hxxp://<a href="http://23.234.51.91/control-MIPS32-MSB" rel="noreferrer" target="_blank">23.234.51.91/control-<wbr>MIPS32-MSB</a><br>
hxxp://<a href="http://23.234.51.91/htam5le" rel="noreferrer" target="_blank">23.234.51.91/htam5le</a><br>
hxxp://<a href="http://23.234.51.91/htmpbe" rel="noreferrer" target="_blank">23.234.51.91/htmpbe</a><br>
hxxp://<a href="http://27.102.101.121/down/1506753086" rel="noreferrer" target="_blank">27.102.101.121/down/<wbr>1506753086</a><br>
hxxp://<a href="http://27.102.101.121/down/1506851514" rel="noreferrer" target="_blank">27.102.101.121/down/<wbr>1506851514</a><br>
IoC Hashes<br>
<br>
3182a132ee9ed2280ce02144e97422<wbr>0a<br>
3d680273377b67e6491051abe17759<wbr>db<br>
41ef6a5c5b2fde1b367685c7b8b3c1<wbr>54<br>
4406bace3030446371df53ebbdc177<wbr>85<br>
4e2f58ba9a8a2bf47bdc24ee74956c<wbr>73<br>
596b3167fe0d13e3a0cfea6a53209b<wbr>e4<br>
6587173d571d2a587c144525195dae<wbr>c9<br>
6f91694106bb6d5aaa7a7eac841141<wbr>d9<br>
704098c8a8a6641a04d25af7406088<wbr>e1<br>
726d0626f66d5cacfeff36ed954dad<wbr>70<br>
76be3db77c7eb56825fe60009de2a8<wbr>f2<br>
95b448bdf6b6c97a33e1d1dbe41678<wbr>eb<br>
9ad8473148e994981454b3b04370d1<wbr>ec<br>
9f8e8b62b5adaf9c4b5bdbce6b2b95<wbr>d1<br>
a3401685d8d9c7977180a5c6df2f64<wbr>6a<br>
abe79b8e66c623c771acf9e21c162f<wbr>44<br>
b2d4a77244cd4f704b65037baf82d8<wbr>97<br>
ca92a3b74a65ce06035fcc280740da<wbr>f6<br>
e9a03dbde09c6b0a83eefc9c295711<wbr>d7<br>
f9ec2427377cbc6afb4a7ff011e0de<wbr>77<br>
fb7c00afe00eeefb5d8a24d524f993<wbr>70<br>
yegenshen<br>
<br>
Read more posts by this author.<br>
______________________________<wbr>_________________<br>
Seguridad mailing list<br>
<a href="mailto:Seguridad@lacnic.net">Seguridad@lacnic.net</a><br>
<a href="https://mail.lacnic.net/mailman/listinfo/seguridad" rel="noreferrer" target="_blank">https://mail.lacnic.net/<wbr>mailman/listinfo/seguridad</a><br>
</blockquote></div><br></div>